JavaScript Path Traversal via path.join/resolve

What it is

The JavaScript application uses path.join() or path.resolve() with user-controlled input without proper validation, enabling path traversal attacks. Attackers can manipulate file paths to access files outside the intended directory structure using sequences like '../' to traverse up the directory tree.

// Vulnerable: Unvalidated path.join() usage
const fs = require('fs');
const path = require('path');

app.get('/files/*', (req, res) => {
  const requestedPath = req.params[0];
  
  // Dangerous: User input directly in path.join
  const filePath = path.join(__dirname, 'public', requestedPath);
  
  fs.readFile(filePath, 'utf8', (err, data) => {
    if (err) {
      return res.status(404).send('File not found');
    }
    res.send(data);
  });
});

// Secure: Path validation with resolve and boundary checking
const fs = require('fs');
const path = require('path');

const PUBLIC_DIR = path.resolve(__dirname, 'public');

app.get('/files/*', (req, res) => {
  const requestedPath = req.params[0];
  
  // Validate input format
  if (!requestedPath || typeof requestedPath !== 'string') {
    return res.status(400).json({ error: 'Invalid path' });
  }
  
  // Remove any traversal attempts
  const safePath = requestedPath.replace(/\.\.\/|\.\.\\\/g, '');
  
  // Resolve the full path
  const filePath = path.resolve(PUBLIC_DIR, safePath);
  
  // Ensure the resolved path is within the public directory
  if (!filePath.startsWith(PUBLIC_DIR + path.sep) && filePath !== PUBLIC_DIR) {
    return res.status(403).json({ error: 'Access denied' });
  }
  
  fs.readFile(filePath, 'utf8', (err, data) => {
    if (err) {
      return res.status(404).json({ error: 'File not found' });
    }
    res.send(data);
  });
});

Why it happens

Applications use Node.js path.join() with user-controlled input believing it provides automatic security against path traversal: const filePath = path.join(baseDir, req.query.file). However, path.join() only normalizes path separators and resolves . and .. - it doesn't restrict traversal outside the base directory. Attackers provide input like '../../../etc/passwd' and path.join() produces valid traversal paths. Developers mistakenly think path.join() is a security function when it's purely for cross-platform path construction. Absolute paths passed to path.join() can completely replace the base path: path.join('/safe', '/etc/passwd') returns /etc/passwd on Unix. Even with path.join(), applications must validate the resulting path stays within intended boundaries.

Fixes

Related Vulnerabilities